Privacy policy

Privacy Policy


Effective date: [Effective Date] · Last updated: [Effective Date]

Vinnocademy, operated by [Company Legal Name], respects your privacy. Your personal data belongs to you; we hold it only as a custodian. This policy explains what we collect, why, who we share it with, and the rights you have under the Personal Data Protection Ordinance, 2025 and other Bangladeshi laws. We never sell your personal data.

3.1 Data we collect

Category

Examples

Who it applies to

Account data

Name, email, mobile number, password (stored encrypted), profile photo

All users

Education profile

Institution, department, level of study, subjects of interest

Students (optional)

Teacher verification

NID or passport details, CV, academic and professional credentials, photo

Teachers

Payout data

Bank account or bKash/Nagad/Rocket number, TIN for tax

Teachers

Transaction data

Courses bought, amount, date, payment method type, transaction ID (not full card numbers or PINs)

Paying Students

Learning activity

Enrolments, progress, quiz and assignment results, certificates, Q&A posts, reviews

Students and Teachers

Communications

Support messages, feedback, survey answers

All users

Technical data

IP address, device and browser type, operating system, approximate location from IP, pages visited, log data

All visitors

Cookies and similar

See our Cookie Policy

All visitors

We do not ask for sensitive personal data such as religion, political opinion, health or biometric data. Please do not post it in public areas like course discussions.

3.2 How we collect it

  • Directly from you when you register, fill in your profile, buy a course, apply to teach, or contact us.
  • Automatically when you use the Platform, through server logs, cookies and similar technologies.
  • From third parties: payment gateways (confirmation of payment), sign-in providers if you choose "Sign in with Google" or similar (name, email, profile photo), and embedded video services.

Purpose

Legal basis

Create and manage your account; deliver courses; track progress; issue certificates

Performance of our contract with you

Process payments, refunds and Teacher payouts

Performance of contract; legal obligations (tax, VAT, financial records)

Verify Teachers and prevent fraud, cheating and misuse

Your consent; establishing or defending legal rights

Provide support and send service messages (receipts, course updates, security alerts)

Performance of contract

Improve the Platform using aggregated analytics

Your consent (via cookie choices)

Send newsletters and offers

Your consent, which you can withdraw at any time

Comply with law, court orders and lawful requests from authorities

Legal obligation

Where we rely on consent, it is voluntary, specific and can be withdrawn at any time without affecting the lawfulness of earlier processing.

3.4 What other users can see

  • Teachers of a course you enrol in can see your name, profile photo, progress, quiz and assignment results, and your questions in that course. They cannot see your email, phone number or payment details.
  • Students can see a Teacher's public profile: name, photo, bio, credentials and courses.
  • Public posts such as reviews and discussion comments show your display name and photo.

3.5 Who we share data with

We share personal data only as needed with:

  • Payment providers such as SSLCommerz, bKash, Nagad and Rocket, to process payments and refunds.
  • Video hosts such as YouTube (Google) and Vimeo, which receive technical data when you watch an embedded video. Their privacy policies apply.
  • Service providers for hosting, email and SMS delivery, customer support and analytics, under contracts that require them to protect your data and use it only on our instructions.
  • Authorities when required by Bangladeshi law or a valid legal order.
  • A buyer or successor if Vinnocademy is merged or sold, who must continue to protect your data under this policy.

3.6 Where your data is stored

We store personal data on secure servers located in [Bangladesh / country of hosting]. Data the law classes as confidential, such as financial data, is stored within Bangladesh as required. Where a service provider processes data outside Bangladesh, we transfer it only to countries or organisations with adequate data-protection standards, and with your consent or as needed to perform our contract with you.

3.7 How long we keep it

  • Account and learning data: while your account is active, and up to 12 months after you close it, then deleted or anonymised.
  • Certificates: a verification record (name, course, date, certificate ID) is kept so employers can verify it, unless you ask us to delete it.
  • Transaction and payout records: for the period required by tax and accounting law, and at least 5 years.
  • Teacher verification documents: while you are a Teacher and for 12 months afterwards.
  • Server logs: up to 90 days, unless needed to investigate a security incident.

3.8 How we protect it

We use HTTPS encryption, encrypted password storage, access controls limited to staff who need the data, regular security testing, and backups. No system is perfectly secure. If a data breach is likely to cause you significant harm, we will notify the relevant authority within the time required by law and inform affected users without undue delay.

3.9 Your rights

You have the right to:

  1. Access the personal data we hold about you and receive a copy in a readable format.
  2. Portability: ask us to transfer your data to another organisation where technically feasible.
  3. Correction of inaccurate or incomplete data. Most details can be edited in your profile settings.
  4. Deletion of your data, subject to records we must keep by law.
  5. Withdraw consent for marketing, analytics cookies or other consent-based processing.
  6. Object to automated decisions that significantly affect you.
  7. Complain to the data protection authority established under Bangladeshi law if you believe we have mishandled your data.

To exercise a right, email [Privacy Email] from your registered email address. We may ask you to verify your identity. We will respond within 30 days.

3.10 Children

Users must be at least 13. Users aged 13 to 17 need a parent's or guardian's consent. We do not track, profile or show targeted advertising to users under 18. If you believe a child has given us data without proper consent, contact [Privacy Email] and we will delete it.

3.11 Marketing

We send promotional emails, SMS or notifications only if you opt in. You can unsubscribe using the link in any email, by replying STOP to SMS, or in your account settings. Service messages such as receipts and security alerts will still be sent.

3.12 Changes to this policy

We will post updates on this page and change the "Last updated" date. For significant changes, we will notify you by email or on the Platform before they take effect.

3.13 Contact

Data protection contact: [Name/Title of Data Officer], [Company Legal Name], [Registered Address] · [Privacy Email] · [Phone / WhatsApp]